ImageMagick Ghostscript delegate hijack via non-standard gswin64c.exe path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects instances where ImageMagick tools (magick.exe, convert.exe, mogrify.exe, identify.exe) launch Ghostscript (gswin64c.exe) from non-standard directory locations while passing specific flags (-dQUIET, -dSAFER, -dBATCH, -dNOPAUSE) that are frequently associated with exploitation payloads (e.g., ImageTragick).